Rule header

We saw in the previous section the basic structure of a Snort rule, and the two top-level parts of a rule, namely rule header and rule options. Based on the rule header structure, rules are classified as traditional, service, file, and file_id. We looked at service, file, and file_id rules in the previous section. In this section, let’s look at the traditional rule header structure.

Traditional rule header

For traditional rules, the rule header structure is as follows:

action protocol source_ip source_port directionality destination_ip destination_port

Action

The action or rule action specifies to Snort what to do when there is a successful match for the rule. The action verb can take any of the following values:

• alert: The alert action causes an alert to be generated and also the corresponding packet to be logged.
• drop: The drop action generates an alert, and the corresponding packet to be dropped (when Snort is running in inline IPS mode...